How the Boston bombing investigation unfolded

BOSTON — Within hours of the Boston Marathon bombing, investigators were already overwhelmed. Bloody clothing, bags, shoes and other evidence from victims and witnesses were piling up. Videos and still images, thousands of them, were pouring in by email and Twitter.

Quickly, the authorities secured a warehouse in Boston's Seaport district and immediately filled the sprawling space: On half of the vast floor, hundreds of pieces of bloody clothes were laid out to dry so they could be examined for forensic clues or flown to FBI labs at Quantico, Va., for testing. In the other half of the room, more than a dozen investigators pored through hundreds of hours of video, "looking for people doing things that are different from what everybody else is doing," Boston Police Commissioner Edward Davis said in an interview Saturday.

It took a couple of days, but analysts began to focus on two men in baseball caps who had brought heavy black bags into the crowd near the marathon's finish line on Monday but left without those bags. The decisive moment came on Wednesday afternoon, when Massachusetts Gov. Deval Patrick got a call from state police: The investigation had narrowed in on the man who would soon be known as Suspect No. 2, the man whom police captured Friday night bleeding and disoriented on a 22-foot boat in a Watertown driveway.

Patrick said the images of Suspect No. 2 reacting to the first explosion provided "highly incriminating" evidence.

How federal and local investigators sifted through that ocean of evidence and focused their search on two immigrant brothers is a story of advanced technology and old-fashioned citizen cooperation.

The killing of Tamerlan Tsarnaev and the capture of his younger brother, Dzhokhar, may seem like an inevitable ending given that their images were repeatedly recorded by store security cameras and bystanders' smartphones. But for 102 hours last week, nothing seemed certain in the manhunt that paralyzed a major metropolis, captivated the nation and confronted counterterrorism operatives with the troubling and unforgiving world of social media and vigilante detective work.

While the analysts combed through videos frame by frame, a more traditional tip was developing two miles away at Boston Medical Center. Jeffrey Bauman, groggy from anesthesia, his legs just removed at the knee, managed to eke out a request for pen and paper.

In the intensive-care ward, Bauman, who had been near the finish line to see his girlfriend complete Monday's race, wrote words that would help lead to quick resolution of the bombings that killed three and injured 176: "Bag. Saw the guy, looked right at me."

FBI agents quickly came to Bauman's bedside. A man in sunglasses and a black baseball cap had walked right up to him, placed a black backpack on the ground and stepped away, Bauman remembered.

His tip became a critical lead, according to law enforcement officials.

Of course, investigators had 2,000 other leads, too, in the form of photos and video that "almost became a management problem, there was so much of it," said Davis, who led the local piece of the inquiry from a ballroom at the Westin Hotel where 100 officers and commanders from local, state and federal law enforcement collaborated.

Davis had learned of the central importance of video from a police commander in London after the public transit bombings there in 2005, when the city's extensive system of surveillance cameras led to identification of four suspects within five days of the attacks, after examination of hundreds of hours of video.

Eight years later, the social media revolution meant that the FBI and Boston authorities were under intense pressure to move even faster, because thousands of amateur sleuths were mimicking the official investigation, inspecting digital images of the crowd on Boylston Street and making their own often wildly irresponsible conclusions about who might be the bombers.

In addition to being almost universally wrong, the theories developed via social media complicated the official investigation, according to law enforcement officials. Those officials said Saturday that the decision on Thursday to release photos of the two men in baseball caps was meant in part to limit the damage being done to people who were wrongly being targeted as suspects in the news media and on the Internet.

Law enforcement officials also debated whether release of the photos would cause the suspects to flee or stage another attack.

Once the photos of the men in caps were made public Thursday, the FBI tip line filled with calls, including one from the brothers' aunt, who provided her nephews' identity, according to federal law enforcement officials.

As investigators expected, making the photos public not only brought in new information, but also spurred the brothers into action.

On Thursday evening, police responding to a robbery at a 7-Eleven in Cambridge, Mass., examined surveillance video and noticed that in addition to the robber, the convenience store had been visited that night by two men who looked like the bombing suspects.

Then, shortly after a Massachusetts Institute of Technology campus officer was shot and killed, police got reports of an armed carjacking of a black Mercedes SUV nearby. The brothers had forced the vehicle's driver to get them money from ATMs in the area. At a Shell station in Cambridge, the security camera provided "extremely good video of two suspects," a clear match with the circulated photos, Davis said.

In a violent confrontation with police in Watertown shortly after the carjacking episode, Tamerlan left the SUV and Dzhokhar, behind the wheel, tried to mow down police officers. In the process, he hit his brother, who was dragged under the car. Tamerlan died early Friday morning. Police positively identified him by comparing his fingerprints against government records, Davis said.

Then Friday night, brother Dzhokhar was captured after a resident of Watertown spotted him hiding in the resident's boat and called 911.